Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A team is implementing shift-left security in their CI/CD pipeline. They want to catch vulnerabilities in third-party libraries and open-source components before they are deployed. Which practice should they add to the pipeline?

   • ARun a DAST tool against the staging environment after deployment.
   • BRun a software composition analysis (SCA) tool during the build stage to scan dependencies for known vulnerabilities.
   • CUse a SAST tool to scan the application's source code for custom code vulnerabilities.
   • DPerform a manual review of the application's configuration files.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A product team is deciding between two security approaches: (1) fixing vulnerabilities during development or (2) fixing them after release. They have a tight release deadline. Which consideration best supports the shift-left approach despite the deadline pressure?

   • APost-release fixes are always cheaper because the team is more experienced.
   • BFixing vulnerabilities during development avoids the higher cost and potential emergency patches after release.
   • CFixing vulnerabilities after release is faster because the team can focus on features now.
   • DShift-left security guarantees the release will not be delayed.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is adopting DevSecOps. The development team is motivated, but the security team is hesitant because they fear losing authority. The operations team is concerned about increased workload. What is the best way to address both concerns while building a DevSecOps culture?

   • ACreate a DevSecOps steering committee with representatives from all teams to define shared security goals and workflows.
   • BImplement a strict top-down mandate from executive leadership.
   • CLet the security team define all security policies without input from other teams.
   • DLet the operations team decide which security controls to implement.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A development team at a financial services firm is planning to adopt shift-left security. They currently perform a single security review after the code is fully integrated, just before release. The team wants to reduce the cost of fixing vulnerabilities and shorten the time between introducing a flaw and detecting it. Which approach best aligns with the core principle of shift-left security?

   • AIncrease the frequency of the pre-release security review to twice per release cycle.
   • BDelay the security review until after the release to avoid slowing down the development process.
   • COutsource the security review to an external penetration testing firm to get a more thorough assessment.
   • DMove security activities such as static analysis and threat modeling to the earliest stages of the SDLC, integrating them into the development workflow.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a key benefit of shift-left security?

   • AReduced cost of fixing vulnerabilities because they are found earlier in the development process
   • BGuaranteed compliance with all regulatory standards
   • CDecreased need for developer training on security topics
   • DElimination of all security vulnerabilities from the final product
   Reveal Solution Discussion Select an answer first